Black Friday Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: cramtick70

GCFA GIACCertified Forensics Analyst Questions and Answers

Questions 4

Which of the following is the correct order of loading system files into the main memory of the system, when the computer is running on Microsoft's Windows XP operating system?

Options:

A.

NTLDR, BOOT.ini, HAL.dll, NTDETECT.com, NTOSKRNL.exe

B.

NTLDR, BOOT.ini, NTDETECT.com, HAL.dll, NTOSKRNL.exe

C.

NTLDR, BOOT.ini, HAL.dll, NTDETECT.com, NTOSKRNL.exe

D.

BOOT.ini, HAL.dll, NTDETECT.com, NTLDR, NTOSKRNL.exe

Buy Now
Questions 5

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate and examine drive image of a compromised system, which is suspected to be used in cyber crime. Adam uses Forensic Sorter to sort the contents of hard drive in different categories. Which of the following type of image formats is NOT supported by Forensic Sorter?

Options:

A.

PFR image file

B.

iso image file

C.

RAW image file

D.

EnCase image file

Buy Now
Questions 6

Which of the following statements about an extended partition are true?

Each correct answer represents a complete solution. Choose two.

Options:

A.

It can be sub-divided into logical drives.

B.

It cannot be formatted or assigned a drive letter.

C.

A maximum of four extended partitions can exist on a single basic disk.

D.

It cannot contain more than one logical drive.

Buy Now
Questions 7

Which of the following two cryptography methods are used by NTFS Encrypting File System (EFS) to encrypt the data stored on a disk on a file-by-file basis?

Options:

A.

Digital certificates

B.

Public key

C.

RSA

D.

Twofish

Buy Now
Questions 8

The MBR of a hard disk is a collection of boot records that contain disk information such as disk architecture, cluster size, and so on. The main work of the MBR is to locate and run necessary operating system files that are required to run a hard disk. In the context of the operating system, MBR is also known as the boot loader. Which of the following viruses can infect the MBR of a hard disk?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Stealth

B.

Boot sector

C.

Multipartite

D.

File

Buy Now
Questions 9

This type of virus infects programs that can execute and load into memory to perform predefined steps for infecting systems. It infects files with the extensions .EXE, .COM, .BIN, and .SYS. As it can replicate or destroy these types of files, the operating system becomes corrupted and needs reinstallation. This type of virus is known as __________.

Options:

A.

Polymorphic virus

B.

Stealth virus

C.

Boot sector virus

D.

File virus

E.

Multipartite virus

Buy Now
Questions 10

In which of the following access control models can a user not grant permissions to other users to see a copy of an object marked as secret that he has received, unless they have the appropriate permissions?

Options:

A.

Discretionary Access Control (DAC)

B.

Access Control List (ACL)

C.

Mandatory Access Control (MAC)

D.

Role Based Access Control (RBAC)

Buy Now
Questions 11

You work as a professional Computer Hacking Forensic Investigator for DataEnet Inc. You want to investigate e-mail information of an employee of the company. The suspected employee is using an online e-mail system such as Hotmail or Yahoo. Which of the following folders on the local computer will you review to accomplish the task?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

History folder

B.

Temporary Internet Folder

C.

Download folder

D.

Cookies folder

Buy Now
Questions 12

Which of the following IP addresses are private addresses?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

19.3.22.17

B.

192.168.15.2

C.

192.166.54.32

D.

10.0.0.3

Buy Now
Questions 13

John works as a Network Administrator for Perfect Solutions Inc. The company has a Linux-based network. John is working as a root user on the Linux operating system. Which of the following commands will John use to display information about all mounted file systems?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

du

B.

ls

C.

df

D.

df -m

Buy Now
Questions 14

Which of the following file systems provides integrated security?

Options:

A.

CDFS

B.

EFS

C.

HPFS

D.

FAT32

Buy Now
Questions 15

You are responsible for maintaining and troubleshooting PC's at your company. The receptionist reports her screen has gone blue. When you get there you notice the 'blue screen of death' with an error message NTFS_FILE_SYSTEM. What is the most likely cause of this error?

Options:

A.

The hard disk is corrupt

B.

A virus

C.

Windows was installed improperly.

D.

Get the latest patch for Windows.

Buy Now
Questions 16

John works as a professional Ethical Hacker. He has been assigned the task of testing the security of www.we-are-secure.com. He has performed the footprinting step and now he has enough information to begin scanning in order to detect active computers. He sends a ping request to a computer using ICMP type 13. What kind of ICMP message is John using to send the ICMP ping request message?

Options:

A.

Address mask request

B.

Echo request

C.

Information request (obsolete)

D.

Timestamp request (obsolete)

Buy Now
Questions 17

Which of the following file systems contains hardware settings of a Linux computer?

Options:

A.

/var

B.

/etc

C.

/proc

D.

/home

Buy Now
Questions 18

Which of the following types of evidence proves or disproves a specific act through oral testimony based on information gathered through the witness's five senses?

Options:

A.

Conclusive evidence

B.

Best evidence

C.

Hearsay evidence

D.

Direct evidence

Buy Now
Questions 19

Which of the following is the process of comparing cryptographic hash functions of system executables and configuration files?

Options:

A.

Spoofing

B.

File integrity auditing

C.

Reconnaissance

D.

Shoulder surfing

Buy Now
Questions 20

Nathan works as a professional Ethical Hacker. He wants to see all open TCP/IP and UDP ports of his computer. Nathan uses the netstat command for this purpose but he is still unable to map open ports to the running process with PID, process name, and path. Which of the following commands will Nathan use to accomplish the task?

Options:

A.

ping

B.

Psloggedon

C.

Pslist

D.

fport

Buy Now
Questions 21

John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.we-are-secure.com. He traceroutes the We-are-secure server and gets the following result:

Considering the above traceroute result, which of the following statements can be true?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

While tracerouting, John's network connection has become slow.

B.

Some router along the path is down.

C.

The We-are-secure server is using a packet filtering firewall.

D.

The IP address of the We-are-secure server is not valid.

Buy Now
Questions 22

A firewall is a combination of hardware and software, used to provide security to a network. It is used to protect an internal network or intranet against unauthorized access from the Internet or other outside networks. It restricts inbound and outbound access and can analyze all traffic between an internal network and the Internet. Users can configure a firewall to pass or block packets from specific IP addresses and ports. Which of the following tools works as a firewall for the Linux 2.4 kernel?

Options:

A.

OpenSSH

B.

IPTables

C.

IPChains

D.

Stunnel

Buy Now
Questions 23

John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.we-are-secure.com. He receives the following e-mail:

The e-mail that John has received is an example of __________.

Options:

A.

Virus hoaxes

B.

Spambots

C.

Social engineering attacks

D.

Chain letters

Buy Now
Questions 24

You work as a Network Administrator for Net World International. Rick, a Sales Manager, complains that his Windows 98 computer is not displaying the taskbar. You reboot his computer and find that the taskbar is still missing. How will you resolve the issue?

Options:

A.

Replace WIN.INI from backup.

B.

Copy the registry from backup.

C.

Use Registry Editor to delete the following registry key:

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerStuckRects

D.

Reinstall Windows 98 on Rick's computer.

Buy Now
Questions 25

Your Windows XP hard drive has 2 partitions. The system partition is NTFS and the other is FAT. You wish to encrypt a folder created on the system partition for the purpose of data security. Which of the following statements is true about this situation?

Options:

A.

You can only encrypt files on the NTFS partition.

B.

You can only encrypt files on the FAT partition.

C.

Since the operating system is on the NTFS partition, you can encrypt files on both.

D.

You cannot encrypt files on either partition.

Buy Now
Questions 26

Adam, a malicious hacker, hides a hacking tool from a system administrator of his company by using Alternate Data Streams (ADS) feature. Which of the following statements is true in context with the above scenario?

Options:

A.

Alternate Data Streams is a feature of Linux operating system.

B.

Adam is using FAT file system.

C.

Adam is using NTFS file system.

D.

Adam's system runs on Microsoft Windows 98 operating system.

Buy Now
Questions 27

Which of the following Acts enacted in United States amends Civil Rights Act of 1964, providing technical changes affecting the length of time allowed to challenge unlawful seniority provisions, to sue the federal government for discrimination and to bring age discrimination claims?

Options:

A.

Sexual Predators Act

B.

Civil Rights Act of 1991

C.

PROTECT Act

D.

The USA Patriot Act of 2001

Buy Now
Questions 28

Which of the following sections of United States Economic Espionage Act of 1996 criminalizes the misappropriation of trade secrets related to or included in a product that is produced for or placed in interstate commerce, with the knowledge or intent that the misappropriation will injure the owner of the trade secret?

Options:

A.

Title 18, U.S.C. 1839

B.

Title 18, U.S.C. 1832

C.

Title 18, U.S.C. 1831

D.

Title 18, U.S.C. 1834

Buy Now
Questions 29

Which of the following tools are used to determine the hop counts of an IP packet?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Netstat

B.

TRACERT

C.

IPCONFIG

D.

Ping

Buy Now
Questions 30

Which of the following switches of the XCOPY command copies file ownerships and NTFS permissions on files while copying the files?

Options:

A.

/r

B.

/p

C.

/s

D.

/o

Buy Now
Questions 31

Allen works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate a computer, which is used by the suspect to sexually harass the victim using instant messenger program. Suspect's computer runs on Windows operating system. Allen wants to recover password from instant messenger program, which suspect is using, to collect the evidence of the crime. Allen is using Helix Live for this purpose. Which of the following utilities of Helix will he use to accomplish the task?

Options:

A.

Mail Pass View

B.

MessenPass

C.

Asterisk Logger

D.

Access PassView

Buy Now
Questions 32

Which of the following components are usually found in an Intrusion detection system (IDS)?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Sensor

B.

Firewall

C.

Modem

D.

Gateway

E.

Console

Buy Now
Questions 33

Victor is a novice Ethical Hacker. He is learning the hacking process, i.e., the steps taken by malicious hackers to perform hacking. Which of the following steps is NOT included in the hacking process?

Options:

A.

Reconnaissance

B.

gaining access

C.

Scanning

D.

Preparation

Buy Now
Questions 34

Which of the following steps are generally followed in computer forensic examinations?

Each correct answer represents a complete solution. Choose three.

Options:

A.

Encrypt

B.

Acquire

C.

Authenticate

D.

Analyze

Buy Now
Questions 35

John works as a professional Ethical Hacker. He has been assigned a project to test the security of www.we-are-secure.com. He copies the whole structure of the We-are-secure Web site to the local disk and obtains all the files on the Web site. Which of the following techniques is he using to accomplish his task?

Options:

A.

Web ripping

B.

TCP FTP proxy scanning

C.

Fingerprinting

D.

Eavesdropping

Buy Now
Questions 36

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate computer of an unfaithful employee of SecureEnet Inc. Suspect's computer runs on Windows operating system. Which of the following sources will Adam investigate on a Windows host to collect the electronic evidences?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Swap files

B.

Unused and hidden partition

C.

Slack spaces

D.

Allocated cluster

Buy Now
Questions 37

Which of the following classes of hackers describes an individual who uses his computer knowledge for breaking security laws, invading privacy, and making information systems insecure?

Options:

A.

White Hat

B.

Black Hat

C.

Gray Hat

D.

Security providing organizations

Buy Now
Questions 38

Which of the following laws enacted in United States makes it illegal for an Internet Service Provider (ISP) to allow child pornography to exist on Web sites?

Options:

A.

Child Pornography Prevention Act (CPPA)

B.

Prosecutorial Remedies and Tools Against the Exploitation of Children Today Act (PROTECT Act)

C.

Sexual Predators Act

D.

USA PATRIOT Act

Buy Now
Questions 39

Peter works as a Security Administrator for SecureEnet Inc. He observes that the database server of the company has been compromised and the data is stolen. Peter immediately wants to report this crime to the law enforcement authorities. Which of the following organizations looks after the computer crimes investigations in the United States?

Options:

A.

Federal Bureau of Investigation

B.

Local or National office of the US secret service

C.

Incident response team

D.

National Institute of Standards and Technology

Buy Now
Questions 40

John works as a professional Ethical Hacker. He has been assigned a project for testing the security of www.we-are-secure.com. He wants to corrupt an IDS signature database so that performing attacks on the server is made easy and he can observe the flaws in the We-are-secure server. To perform his task, he first of all sends a virus that continuously changes its signature to avoid detection from IDS. Since the new signature of the virus does not match the old signature, which is entered in the IDS signature database, IDS becomes unable to point out the malicious virus. Which of the following IDS evasion attacks is John performing?

Options:

A.

Evasion attack

B.

Session splicing attack

C.

Insertion attack

D.

Polymorphic shell code attack

Buy Now
Questions 41

Which of the following file systems supports disk quotas?

Options:

A.

FAT32

B.

NTFS

C.

FAT

D.

CDFS

Buy Now
Questions 42

Which of the following Windows XP system files handles memory management, I/O operations, and interrupts?

Options:

A.

Ntoskrnl.exe

B.

Win32k.sys

C.

Advapi32.dll

D.

Kernel32.dll

Buy Now
Questions 43

Which of the following precautionary steps are taken by the supervisors or employers to avoid sexual harassment in workplace?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Establish a complaint mechanism.

B.

Communicate to an employee who is indulging in such behavior.

C.

Contact the police and take legal action.

D.

Immediately take action on the complaint.

Buy Now
Questions 44

Which of the following tools is a wireless sniffer and analyzer that works on the Windows operating system?

Options:

A.

Kismet

B.

Airsnort

C.

Void11

D.

Aeropeek

Buy Now
Questions 45

You work as the Network Administrator for McNeil Inc. The company has a Unix-based network. You want to query an image root device and RAM disk size. Which of the following Unix commands can you use to accomplish the task?

Options:

A.

rdev

B.

mount

C.

setfdprm

D.

rdump

Buy Now
Questions 46

Which of the following type of files is NOT deleted by Disk Cleanup program of Windows XP?

Options:

A.

Old data files

B.

Temporary Setup Files

C.

Temporary Internet Files

D.

Offline Files

Buy Now
Questions 47

In 2001, the Council of Europe passed a convention on cybercrime. It was the first international treaty seeking to address computer crime and Internet crimes by harmonizing national laws, improving investigative techniques, and increasing cooperation among nations. On 1 March 2006, the Additional Protocol to the Convention on Cybercrime came into force. Which of the following statements clearly describes this protocol?

Options:

A.

The convention of cybercrime is only applied within Europe.

B.

It requires participating states to criminalize the dissemination of racist and xenophobic material through computer systems.

C.

The convention of cybercrime should immediately be put on hold until there is an inclusion of a new or amended article.

D.

English speaking states in Europe such as Ireland and the United Kingdom should sign the convention.

Buy Now
Exam Code: GCFA
Exam Name: GIACCertified Forensics Analyst
Last Update: Nov 24, 2024
Questions: 318
GCFA pdf

GCFA PDF

$25.5  $84.99
GCFA Engine

GCFA Testing Engine

$30  $99.99
GCFA PDF + Engine

GCFA PDF + Testing Engine

$40.5  $134.99